CSC NIST Risk Management Framework 2

Question 1

Which RMF step is responsible for selecting the initial set of security controls based on the system's impact level?

Accepted Answer

Select

Answer

Assess

Answer

Implement

Answer

Authorize

Question 2

What document formally records the security controls selected for an information system and their implementation status?

Accepted Answer

System Security Plan (SSP)

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

Authorization to Operate (ATO)

Question 3

In the RMF Assess step, who typically conducts the security control assessment?

Accepted Answer

An independent assessor or assessment team

Answer

The system owner

Answer

The authorizing official

Answer

The information system security officer

Question 4

What is the primary output of the RMF Assess step?

Accepted Answer

Security Assessment Report (SAR)

Answer

Authorization to Operate (ATO)

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Question 5

Which NIST publication provides the catalog of security and privacy controls used during the RMF Select step?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-30

Answer

FIPS 199

Question 6

An organization identifies a control deficiency but cannot remediate it before the authorization deadline. What document captures this risk?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Answer

Risk Executive Framework

Question 7

In a federal context, who holds ultimate accountability for accepting the residual risk of operating an information system?

Accepted Answer

Authorizing Official (AO)

Answer

Information System Security Officer (ISSO)

Answer

System Owner

Answer

Chief Information Officer (CIO)